Nomic nBTC Bridge Hack

On September 9, 2026, a flaw in Nomic's custom forwarding mechanism allowed an attacker to double-spend nBTC and send ~39.84 unbacked nBTC vouchers (~$3.15M USD) to Osmosis, compromising roughly 36% of the backing behind Osmosis's Alloyed BTC (allBTC) token.

The attacker exploited a vulnerability in Nomic's custom transaction forwarding system to double-spend nBTC and issue unbacked vouchers through the Inter-Blockchain Communication (IBC) protocol onto Osmosis. Because nBTC serves as a reserve component for Osmosis's unified Alloyed BTC pool, the forged vouchers left allBTC ~36% undercollateralized. Core IBC and Osmosis smart contracts were not directly breached.

Following detection, Osmosis paused all minting, redemptions, inflows, and outflows for Nomic and Alloyed BTC. Osmosis validators then executed an emergency chain upgrade that successfully froze 22.65 BTC residing in the attacker's Osmosis account. Osmosis announced plans for a governance vote to seize the 22.65 frozen BTC and reimburse the remaining ~17.19 BTC shortfall from the community pool's BTC reserves to fully restore 1:1 backing.